Secure execution guest owner environmental controls

ABSTRACT

A method, computer program product, and a system where a secure interface control determines whether an instance of a secure guest image can execute based on metadata. The secure interface control (“SC”) obtains metadata linked to an image of a secure guest of an owner and managed by the hypervisor that includes control(s) that indicates whether the hypervisor is permitted to execute an instance of a secure guest generated with the image in the computing system based on system setting(s) in the computing system. The SC intercepts a command by the hypervisor to initiate the instance. The SC determines the presence or the absence of system setting(s) in the computing system. The SC determines if the hypervisor is permitted to execute the instance. If so, the SC enables initiation of the instance by the hypervisor. If not, the SC ignores the command.

BACKGROUND

In today's computer systems and information transport networks,cryptographic elements are important technological components.Information may be stored or transmitted in a cryptographically securedform in order to avoid unauthorized access to the information stored ortransmitted. In some cases, pure software-based techniques may be usedand, in other cases, hardware support and security specific elements maybe used to perform such data protection.

A hypervisor or virtual machine manager can control various guests(e.g., virtual machines, virtual servers) with access to systemresources. Different guests managed by a common hypervisor can begenerated by different owners. Of these guests, some can be secureguests. A traditional hypervisor has full control over all guestshosted. In particular, the hypervisor has the capability to inspect andeven modify all memory of the hosted guest. In a cloud environment sucha setup requires the hypervisor and its administrators to be fullytrustworthy.

A secure guest is a guest that can be hosted by hypervisors that are not(fully) trustworthy. The image of such a guest would be protected whenloaded and the protection of the contents of the resources assigned tothe guest (e.g., memory, CPU registers) would be maintained throughoutthe lifetime of the guest. The protection of the guest comprises atleast integrity protection (e.g., hypervisor cannot maliciously changeany guest states) and in addition can comprise maintaining theconfidentiality of the initial image and code and data running in theguest. These services can apply to any interface between a secure entityand another untrusted entity that traditionally allows access to thesecure resources by this other entity.

SUMMARY

Shortcomings of the prior art are overcome and additional advantages areprovided through the provision of a method for enabling an owner tocontrol execution of a secure guest in a given technical environment.The method includes, for instance: obtaining, by a secure interfacecontrol in a computing system, wherein the secure interface control iscommunicatively coupled to a hypervisor, wherein the hypervisor managesone or more guests, metadata linked to an image of a secure guest of anowner and managed by the hypervisor, wherein the metadata comprises oneor more controls, wherein each control of the one or more controlsindicates to the secure interface control whether the hypervisor ispermitted to execute an instance of a secure guest generated with theimage in the computing system based on a presence or absence of one ormore system settings in the computing system; intercepting, by thesecure interface control, a command by the hypervisor to initiate theinstance of the secure guest from the image of the secure guest;determining, by the secure interface control, the presence or theabsence of the one or more system settings in the computing system;determining, by the secure interface control, based on the one or morecontrols and the presence or the absence of the one or more systemsettings, if the hypervisor is permitted to execute the instance; basedon determining that the hypervisor is permitted to execute the instance,enabling, by the secure interface control, initiation of the instance bythe hypervisor, in the computing system, based on relaying theintercepted command to the hypervisor; and based on determining that thehypervisor is not permitted to execute the instance, ignoring, by thesecure interface control, the command.

Shortcomings of the prior art are overcome and additional advantages areprovided through the provision of a computer program product forenabling an owner to control execution of a secure guest in a giventechnical environment. The computer program product comprises a storagemedium readable by a processing circuit and storing instructions forexecution by the processing circuit for performing a method. The methodincludes, for instance: obtaining, by the one or more processors in acomputing system, wherein the one or more processors are communicativelycoupled to a hypervisor, wherein the hypervisor manages one or moreguests, metadata linked to an image of a secure guest of an owner andmanaged by the hypervisor, wherein the metadata comprises one or morecontrols, wherein each control of the one or more controls indicates tothe one or more processors whether the hypervisor is permitted toexecute an instance of a secure guest generated with the image in thecomputing system based on a presence or absence of one or more systemsettings in the computing system; intercepting, by the one or moreprocessors, a command by the hypervisor to initiate the instance of thesecure guest from the image of the secure guest; determining, by the oneor more processors, the presence or the absence of the one or moresystem settings in the computing system; determining, by the one or moreprocessors, based on the one or more controls and the presence or theabsence of the one or more system settings, if the hypervisor ispermitted to execute the instance; based on determining that thehypervisor is permitted to execute the instance, enabling, by the one ormore processors, initiation of the instance by the hypervisor, in thecomputing system, based on relaying the intercepted command to thehypervisor; and based on determining that the hypervisor is notpermitted to execute the instance, ignoring, by the one or moreprocessors, the command.

Shortcomings of the prior art are overcome and additional advantages areprovided through the provision of a system for enabling an owner tocontrol execution of a secure guest in a given technical environment.The system comprises a memory, one or more processors in communicationwith the memory, and program instructions executable by the one or moreprocessors via the memory to perform a method. The method includes, forinstance: obtaining, by the one or more processors in the system,wherein the one or more processors are communicatively coupled to ahypervisor, wherein the hypervisor manages one or more guests, metadatalinked to an image of a secure guest of an owner and managed by thehypervisor, wherein the metadata comprises one or more controls, whereineach control of the one or more controls indicates to the one or moreprocessors whether the hypervisor is permitted to execute an instance ofa secure guest generated with the image in the computing system based ona presence or absence of one or more system settings in the computingsystem; intercepting, by the one or more processors, a command by thehypervisor to initiate the instance of the secure guest from the imageof the secure guest; determining, by the one or more processors, thepresence or the absence of the one or more system settings in thecomputing system; determining, by the one or more processors, based onthe one or more controls and the presence or the absence of the one ormore system settings, if the hypervisor is permitted to execute theinstance; based on determining that the hypervisor is permitted toexecute the instance, enabling, by the one or more processors,initiation of the instance by the hypervisor, in the computing system,based on relaying the intercepted command to the hypervisor; and basedon determining that the hypervisor is not permitted to execute theinstance, ignoring, by the one or more processors, the command.

Methods and systems relating to one or more aspects are also describedand claimed herein. Further, services relating to one or more aspectsare also described and may be claimed herein.

Additional features are realized through the techniques describedherein. Other embodiments and aspects are described in detail herein andare considered a part of the claimed aspects. For example, in someembodiments of the present invention, the one or more processors or thesecure interface control obtaining the metadata further comprises:decrypting, by the one or more processors or the secure interfacecontrol, a portion of the metadata linked to the image of the secureguest, wherein the metadata is integrity protected and the portioncomprising a cryptographic measure of a boot image of the secure guestwas encrypted by a key derived using a private key.

In some embodiments of the present invention, the encrypted portion ofthe metadata comprises the one or more controls.

In some embodiments of the present invention, each control of the one ormore controls comprises an environmental constraint.

In some embodiments of the present invention, the environmentalconstraints are selected from the group consisting of: systemsconfigured to perform hardware measurements, and systems configured touse a non-system specific host key.

In some embodiments of the present invention, the private key is ownedby the secure interface control and used exclusively by the secureinterface control.

In some embodiments of the present invention, the key derived using theprivate key is shared between the secure interface control and theowner.

In some embodiments of the present invention, the metadata comprisesvalues derived from a boot image of the secure guest computed utilizinga collision resistant one-way function.

In some embodiments of the present invention, the one or more controlseach comprise a positive designation or a negative designation for agiven system settings, wherein the positive designation indicates thatthe instance of the secure guest is permitted to execute in thecomputing system comprising the given system setting and the negativedesignation indicates that the instance of the secure guest is notpermitted to execute in the computing system comprising the given systemsetting.

In some embodiments of the present invention, the metadata isinaccessible to the instance of the secure guest.

In some embodiments of the present invention, determining if thehypervisor is permitted to execute the instance further comprises:identifying, by the one or more processors and/or the secure interfacecontrol, in the one or more controls, a control relevant to a setting ofthe one or more system settings; and determining, by the one or moreprocessors and/or the secure interface control, if the control enablesor restricts executing the instance, based on the control.

In some embodiments of the present invention, the method furthercomprises: monitoring, by the one or more processors and/or the secureinterface control, the one or more system settings during runtime of theinstance; determining, by the one or more processors and/or the secureinterface control, that at least one setting of the one or more settingschanged during the runtime; identifying, by the one or more processorsand/or the secure interface control, a given control of the one or morecontrols relevant to the at least one setting; and determining, by theone or more processors and/or the secure interface control, based on theat least one setting and the given control if the hypervisor ispermitted to execute the instance. Based on determining that thehypervisor is not permitted to execute the instance, terminating, by theone or more processors and/or the secure interface control, via thehypervisor, the instance.

In some embodiments of the present invention, intercepting the commandby the hypervisor to initiate the instance of the secure guest from theimage of the secure guest further comprises: performing, by the one ormore processors and/or the secure interface control, an integrity checkon the metadata; and based on successfully completing the integritycheck, reading, by the one or more processors and/or the secureinterface control, the one or more controls in the metadata.

BRIEF DESCRIPTION OF THE DRAWINGS

One or more aspects are particularly pointed out and distinctly claimedas examples in the claims at the conclusion of the specification. Theforegoing and objects, features, and advantages of one or more aspectsare apparent from the following detailed description taken inconjunction with the accompanying drawings in which:

FIG. 1 is a workflow that illustrates certain aspects of someembodiments of the present invention;

FIG. 2 illustrates various aspects of some embodiments of the presentinvention;

FIG. 3 is a workflow that illustrates certain aspects of someembodiments of the present invention;

FIG. 4 depicts one embodiment of a computing node that can be utilizedin a cloud computing environment;

FIG. 5 depicts a cloud computing environment according to an embodimentof the present invention; and

FIG. 6 depicts abstraction model layers according to an embodiment ofthe present invention.

DETAILED DESCRIPTION

The accompanying figures, in which like reference numerals refer toidentical or functionally similar elements throughout the separate viewsand which are incorporated in and form a part of the specification,further illustrate the present invention and, together with the detaileddescription of the invention, serve to explain the principles of thepresent invention. As understood by one of skill in the art, theaccompanying figures are provided for ease of understanding andillustrate aspects of certain embodiments of the present invention. Theinvention is not limited to the embodiments depicted in the figures.

As understood by one of skill in the art, program code, as referred tothroughout this application, includes both software and hardware. Forexample, program code in certain embodiments of the present inventionincludes fixed function hardware, while other embodiments utilized asoftware-based implementation of the functionality described. Certainembodiments combine both types of program code. One example of programcode, also referred to as one or more programs, is depicted in FIG. 4 asprogram/utility 40, having a set (at least one) of program modules 42,may be stored in memory 28.

A virtual machine (VM), running as a guest under the control of a hosthypervisor, relies on that hypervisor to transparently providevirtualization services for that guest. These services can apply to anyinterface between a secure entity and another untrusted entity thattraditionally allows access to the secure resources by this otherentity. The term ‘guest system’ or ‘guest’ can denote, e.g., anoperating system being executed in a virtual machine, VM, on ahypervisor. A user can be assigned to the guest system. It can be that aspecific cryptographic key can be assigned to the guest system. Thementioned hypervisor can be used in performing such an assignment. Theguest system can, e.g., be a virtual machine, i.e., a VM, running orexecuting a guest operating system.

The term ‘content’ can denote any character-based string. The string cancomprise readable text or any other binary data.

The term ‘cryptographically linked’ utilized to express that a firstcomponent is cryptographically linked to a second component, means thatthe first component is integrity protected and contains a measure of alldata contained in the second component. The measure being produced by acollision resistant one-way function. Examples of such measures include,but are not limited to, cryptographic hashes, message authenticationcodes, and/or cryptographic signatures.

Embodiments of the present invention include a computer-implementedmethod, a computer program product, and a computer system that includeprogram code executed on at least one processing circuit and/or hardwarecomprising program code that enables an owner of a secure execution (SE)guest to instruct a secure interface control that is hardware, firmware,or a combination thereof, to instruct the secure interface control toallow or not to allow a secure guest to run in a specific hostenvironment. In embodiments of the present invention, the instruction ofthe guest owner is specific to a particular guest image. Thus, the ownercommunicates one or more environmental constraints to the secure controlinterface for each guest, such that the secure interface control canenforce the one or more constraints, in a given system. In embodimentsof the present invention, the owner communicates the particularenvironmental constraints for a given image via metadata that iscryptographically linked to the boot image of the secure guest and thesecure interface control enforces the specified particulars, inembodiments of the present invention, for the given secure guest. Insome embodiments of the present invention, the metadata associated witha secure guest is integrity protected (e.g., at least part of themetadata can be encrypted). The metadata can contain values derived byprogram code from the boot image of the secure guest that the programcode computes using a collision resistant one-way function (e.g., acryptographic hash function). The collision resistant function providessecurity to the values because its application renders computationallyinfeasible constructing an alternative image for which the same valuescan be derived. In some embodiments of the present invention, themetadata comprises specific positive and negative designations relevantto various environmental constraints. In some embodiments of the presentinvention, the metadata comprises installation data of the secure guest(e.g., the secure execution (SE) header).

In embodiments of the present invention, the secure interface controlprotects the (host) system from executing a secure guest that conflictswith system settings. The secure interface control prevents thisconflict both by rejecting requests to initiate a secure guest based ondetermining that controls in metadata cryptographically linked to theimage of the secure guest designate the secure guest incompatible withthe system and by monitoring the technical environment after executingthe secure guest and determining that a change in the technicalenvironment renders the secure guest no longer compatible with thetechnical environment. If during runtime, a change to a technicalenvironment in which a secure guest is executing creates a conflict withthe controls (when the controls in metadata cryptographically linked tothe image of the secure guests initially permitted the secure interfacecontrol to initiate the secure guests), the secure interface controlinitiates a termination of the secure guest by the hypervisor. Forexample, in embodiments of the present invention, when the secureinterface control evaluates whether to start a secure guest: 1) thesecure interface control reads individual controls denotingenvironmental constraints in metadata that is cryptographically linkedto the image of the secure guest; 2) the secure interface controlcompares the controls to system settings of the host system in which theimage would execute, if started; 3) the secure interface control startsthe secure guest if the system settings match the environmental controlsin the metadata; and 4) the secure interface control monitors the systemsettings of the technical environment in which the secure guest isexecuted, and during runtime, if the secure interface control determinesthe system settings have changed in a way that conflicts with thecontrols, the secure interface control terminates the secure guest.Examples of system settings that can be embodied in controls comprisingenvironmental constraints in the metadata can include, but are notlimited to: 1) systems configured to do hardware measurements; and 2)systems configured to use a non-system specific host key.

FIG. 1 is a workflow 100 that illustrates certain functionality of someembodiments of the present invention. As will be illustrated in FIG. 1,in embodiments of the present invention, to enable secure execution, animage of a secure guest is cryptographically linked from metadata, whichis securely communicated to a secure interface control (e.g., a trustedhardware and/or software component, trusted firmware) based on a privatehost key, which is accessible to the secure interface control, only. Inembodiments of the present invention, an owner of the secure guestdetermines the secure interface control behavior, allowing orprohibiting the execution of the secure guest in certain technicalenvironments. An advantage of embodiments of the present invention overexisting approaches to secure guest security is that the granularcontrols in the metadata, as enforced by the secure interface control,allow the owner to limit execution of secure guests in order to addressspecific security concerns. For example, the owner can control whetherthe secure interface control can initiate a secure guest on a hostsystem configured to do hardware measurements and/or on a host systemconfigured to use a non-system specific host key. In some embodiments ofthe present invention, program code executing on at least one processingcircuit and/or provided by hardware, constrains the execution of asecure guest.

Referring to FIG. 1, in some embodiments of the present invention, asecure interface control (e.g., hardware, software, firmware, acombination, etc.) intercepts a request to initiate a secure guest basedon an image of the secure guest (105). The secure interface controlobtains metadata linked to the secure guest to be started, from an ownerof the secure guest (110). In some embodiments of the present invention,the metadata is integrity protected and cryptographically linked to aboot image of the secure guest to be started by an (SE) owner. Themetadata comprises controls and each control denotes a restriction forthe secure guest; these restrictions comprise environmental constraints.

Returning to FIG. 1, in an embodiments of the present invention, thesecure interface control performs an integrity check on the metadata(120). If the secure control interface determines that the metadata doesnot pass the integrity check, the secure control interface returns anerror to the owner (or other requestor for the instance of the secureguest) (125). By returning an error to the owner based on a failedintegrity check, the secure interface control forecloses the requestedinitiation of the secure guest. Even if the metadata passes theintegrity check, the secure interface control can still abort theinitiation of the secure guest.

If the secure interface control determines that the metadata passes theintegrity check, the secure interface control obtains the controls inthe metadata (130). The secure interface control analyzes systemsettings of the host system to determine whether the system settings arecompatible with the controls in the metadata, to determine if the secureguest is permitted to be started in the system (140). If the secureinterface control determines that starting the secure guest is notpermitted, based on the metadata, the secure interface control returnsan error to the owner and/or the entity that requested initiation of thesecure guest (145). By returning an error, the secure interface controlhas aborted an attempt to start a secure guest. In some embodiments ofthe present invention, the secure interface control ignores the requestto start the secure guest. Depending on a configuration of the secureinterface control, a response to a command from a hypervisor to start asecure guest (from an image), where metadata linked to the imageindicates that the secure guest is not permitted in the given system,based on the controls being incompatible with the system settings, canvary. If the secure interface control determines that the secure guestis permitted, based on the metadata and the system settings, the secureinterface control enables the hypervisor to initiate the secure guest,based on the image (150). Because the secure interface controlintercepts attempts to start a secure guest, the secure interfacecontrol discontinues a command to start a secure guest before the secureguest can be started. Thus, the secure interface control effectivelydenies requests that conflict with system settings, based on controls inthe metadata. The prevention and allowance of various secure guests isaccomplished by the secure interface control before any other componentof the system can initiate the secure guests. For example, in someembodiments of the present invention, the controls in the metadatalinked to an image of a secure guest can instruct the secure interfacecontrol to constrain a secure guest, based on the host system beingconfigured to do hardware measurements and/or on a host systemconfigured to use a non-system specific host key.

Returning to FIG. 1, as discussed above, during runtime of the secureguest, the secure interface control can monitor the system settings(160) and if the secure interface control determines that the systemsettings have changed in a manner that conflict with the controls, whichindicated that the secure guest was allowed to execute in theenvironment, the secure interface control can terminate the secure guest(and/or cause the hypervisor to terminate the secure guest), duringruntime (170). The secure interface control can continue monitoring thesystem settings in case of the emergence of this type of change (165).In some embodiments of the present invention, the secure interfacecontrol instructs (e.g., forces) the hypervisor to terminate the secureguest.

FIG. 2 is a technical environment 200 that includes various aspects ofsome embodiments of the present invention. The components that comprisethe technical environment 200 of FIG. 2 illustrate how a secureinterface control enables a guest owner to control functionality of aguest image, via encryption unique to each owner, and the secureinterface control enables/disables a secure guest, based on a givenimage, to execute in particular host environments. For Secure Execution,a secure guest 210 is cryptographically linked to metadata 240, which issecurely communicated to a secure interface control 230 (e.g., trustedfirmware, trusted component, etc.), based on a private host key which isaccessible to the secure interface control 230, only. The owner of thesecure guest 210 controls the secure interface control 230 allowing orprohibiting execution of the secure guest 210, based on environmentalconstraints imposed by the owner. For example, the environmentalconstraints imposed by the owner, through the secure interface control230, could limit execution of a secure guest in a host system configuredto do hardware measurements and/or on a host system configured to use anon-system specific host key. In some embodiments of the presentinvention, the key to encrypt portions of the metadata is derived usinga private key that is only accessible to the secure interface control230. Based on the preferences of the owner, as noted in the metadata 240associated with the secure guest 210, the secure interface control 230controls initiation of the secure guest 210, based on system settings270. The secure interface control 230 also monitors the system settings270 during runtime, so that the secure interface control 230 can causethe hypervisor 220 to terminate the secure guest 210, if and when thesystem settings 270 change such that the controls 260 no longer indicatethat the secure guest 210 is compatible with the technical environment200.

In some embodiments of the present invention, a secure guest 210 (e.g.,virtual machine, virtual server) is controlled by a hypervisor 220(e.g., virtual machine manager). The secure interface control 250obtains, from an owner of the secure guest 210, via the hypervisor 220,metadata associated with the secure guest 240. This metadata 240 isintegrity protected (and part of the metadata 240, i.e., a secret ofsecure guest 250 is also confidentiality protected (i.e., encrypted)).In some embodiments of the present invention, the metadata 240 iscryptographically linked to the boot image of the secure guest 210. Insome embodiments of the present invention, the secret of the secureguest 250 is contained in the installation data of the secure guest(e.g., the secure execution (SE) header), which the secure interfacecontrol 230 obtains from the owner. In some embodiments of the presentinvention, the metadata 240 contains values derived from the boot imageof the secure guest 210 that are computed using a collision resistantone-way function (e.g., a cryptographic hash function) such thatconstructing an alternative image for which the same values can bederived is computationally infeasible.

As illustrated in FIG. 2, the metadata linked to the secure guest 240comprises a secret 250. In some embodiments of the present invention,the metadata of the guest is integrity protected and the secret isencrypted by a key derived using a private key owned by the secureinterface control 230. The data encrypted by the key can comprises acryptographic measure of a boot image of the given guest. Thus, in someembodiments of the present invention, the portion of the metadata 240that contains the secret 250 is encrypted by a key that only the secureinterface control 230 can compute. The metadata 240 need not beaccessible to the secure guest 210, itself.

The metadata 240 is linked to the image of the secure guest 210, thesecret 250 being cryptographically linked to the image of the secureguest, but it is not part of the guest. Rather, as described herein, itis independently transported to the secure interface control (e.g.,firmware, a trusted component, software, hardware, etc.) (e.g., FIG. 1,110). In embodiments of the present invention, the secret 250 istransported though a secure channel (i.e., encrypted) as part of theguest metadata and cryptographically linked to the guest. In someembodiments of the present invention, the metadata 240 iscryptographically linked to a guest (e.g., contains a signature of theguest image) so metadata of one guest cannot be misused as metadata ofanother guest. Thus, the secure interface control 230 can verify thatthe guest image and metadata/secret belong together (e.g., FIG. 1, 120).The metadata 240 transferred (e.g., independently, through a securechannel) to the secure interface control 230 is integrity andconfidentiality protected.

In addition to including a secret 250, the metadata 240 also includescontrols 260, which the secure interface control 230 utilizes to enableand prohibit the hypervisor 220 to initiate/execute the secure guest210. Whether the secure guest 210 is permitted to initiate (and, in somecases, to continue running) in the technical environment 200, isdetermined by the secure interface control 230, based on comparing thecontrols 260 in the metadata 240 to the system settings 270. The secureinterface control 230 does not enable a hypervisor 220 to initiate thesecure guest 210 and during runtime, can cause the hypervisor 220 toterminate a secure guest 210 based on restrictions described by themetadata 240 (e.g., the controls 260) that indicate an incompatibilitywith the technical environment 200, based on the system settings 270. Insome embodiments of the present invention, the metadata 240 containscontrols 260 denoting compatibility with aspects of a given technicalenvironment, if the controls are positive, or constraints to running ina given technical environment, if the controls are negative. When thesystem settings 270 change after a secure guest 210 was previouslyinitiated based on prior system settings 270 values, the secureinterface control 230 can cause the hypervisor 220 to terminate, thesecure guest 210, during runtime, because on the secure interfacecontrol 230 determining that the changed system settings 270 areincompatible with the controls 260 such that the controls 260 indicatethat the secure guest 210 in constrained from executing in the technicalenvironment 200.

In embodiments of the present invention, the controls 260 in themetadata 240 linked to the image of the secure guest 210 denote one ormore environmental constraints. In some embodiments of the presentinvention, depending on the setting of a given control of the controls260, a secure guest 210 can be started or not started, if the relevantenvironmental constraint is met (e.g., by the system settings 270). Forexample, when such a control is negative, the secure interface control230 can inhibit the start of a secure guest (e.g., by a hypervisor 220)when the associated environmental constraint is met. Otherwise if thecontrol is positive, the secure interface control 230 can allow thestart of a secure guest 210 (e.g., by the hypervisor 220) when theassociated environmental constraint is met. When evaluating the metadata240 for a secure guest 210, the secure interface control 230 can readthe controls 260 and for each control, the secure guest 210 determineswhether the computing environment 200 meets the associated environmentalconstraint for each control, based on the system settings 270.

FIG. 3 is a workflow 300 that illustrates various aspects of someembodiments of the present invention. As illustrated in FIG. 3, aspectsof various embodiments of the present invention enable an owner of asecure execution guest to instruct a secure interface control to allowor not to allow the secure guest of the owner to run in a specific hostenvironment. The decision of the guest owner can be specific to aparticular guest image and the guest owner communicates the decision tothe system, in general, to be enforced, by the system (i.e., by thesecure interface control), utilizing the metadata cryptographicallylinked to the secure guest.

Returning to FIG. 3, in an embodiment of the present invention, a secureinterface control in a computing system, where the secure interfacecontrol is communicatively coupled to a hypervisor and the hypervisormanages one or more guests, obtains metadata linked to an image of asecure guest to be started by the hypervisor, where the metadatacomprises one or more controls, where each control of the one or morecontrols indicates to the secure interface control whether a secureguest is permitted to execute in a particular technical environment(310). The metadata itself can be inaccessible to the secure guest. Aspart of obtaining the metadata, in some embodiments of the presentinvention, the secure interface control decrypts a portion of themetadata linked to an image of a secure guest. The metadata is integrityprotected and this portion was encrypted by a key derived using aprivate key comprising a cryptographic measure of a boot image of thesecure guest, in some embodiments of the present invention. The privatekey can be owned by the secure interface control and used exclusively bythe secure interface control. A key derived using the private key can beshared between the secure interface control and the owner (e.g., only).In some embodiments of the present invention, the metadata includesvalues derived from a boot image of the secure guest computed utilizinga collision resistant one-way function.

As illustrated in FIG. 2, the one or more controls (e.g., FIG. 2, 260)are part of the metadata (e.g., FIG. 2, 240). In some embodiments of thepresent invention, the one or more controls are contained in anencrypted portion of the metadata. The secure interface control candecrypt this portion of the metadata, which is linked to an image of thesecure guest, where the metadata is integrity protected and theencrypted portion comprising a cryptographic measure of a boot image ofthe secure guest, the encrypted portion encrypted by a key derived usinga private key. In some embodiments of the present invention, the privatekey is by a key derived using a private key comprising a cryptographicmeasure of a boot image of the secure guest. The controls can eachcomprise a positive designation or a negative designation for varioussystem settings, where the positive designation indicates that thesecure guest is permitted to execute based on a given system setting andthe negative designation indicates that the guest is not permitted toexecute based on the given system setting.

Referring to FIG. 3, the secure interface control intercepts a commandto start a secure guest, based on the image (320). In some embodimentsof the present invention, the command is by the hypervisor (e.g., anon-secure entity) that manages guest execution of the host system. Thesecure interface control determines, based on the one or more controls,if the secure guest is permitted to execute in the technicalenvironment, as defined by the system settings (330). To determinewhether the secure guest is permitted to execute, in some embodiments ofthe present invention, the secure interface control identifies, in theone or more controls, a control relevant to one or more of the systemsettings (334). The secure interface control determines if the controlenables or restricts executing the secure guest based on the systemsettings (336).

Based on determining that the secure guest is permitted to execute, thesecure interface control enables the hypervisor to commence execution ofthe secure guest, based on the image, within the computing system (340).Based on determining that the secure guest is not permitted to execute,the secure interface control ignores the command to start the secureguest (345). By ignoring the command, the secure control interfaceprevents the hypervisor from commencing execution of the secure guest.

In some embodiments of the present invention, the secure interfacecontrol, during runtime of the secure guest, determines that a changehas been made to the settings (350). The secure interface controldetermines, based on the one or more controls, if the secure guest ispermitted to execute in the technical environment, as defined by thesystem settings (based on the change) (330). To determine whether thesecure guest is permitted to execute, in some embodiments of the presentinvention, the secure interface control identifies, in the one or morecontrols, a control relevant to one or more of the system settings(334). The secure interface control determines if the control enables orrestricts executing the secure guest based on the system settings (336).Based on determining that the secure guest is permitted to execute, thesecure interface control enables the hypervisor to continue execution ofthe secure guest, based on the image, within the computing system (340).Based on determining that the secure guest is not permitted to execute,the secure interface control causes the hypervisor to terminate thesecure guest (335).

Embodiments of the present invention include a computer-implementedmethod, a computer program product, and a computer system, where asecure interface control in a computing system, where the secureinterface control can be any one of or a combination of firmware,hardware, and software, obtains metadata linked to an image of a secureguest to be started by an owner and managed by a hypervisor. Thehypervisor manages one or more guests and the metadata comprises one ormore controls. Each control of the one or more controls indicates to thesecure interface control whether a secure guest generated with the imageis permitted to be initiated (or maintained) by a secure interfacecontrol, based on system settings. For example, in some embodiments ofthe present invention, program code of secure interface control(software, hardware, and/or firmware, etc.) in a computing systemobtains metadata linked to an image of a secure guest of an owner andmanaged by the hypervisor, where the secure interface control iscommunicatively coupled to a hypervisor, where the hypervisor managesone or more guests, where each control of the one or more controlsindicates to the secure interface control whether the hypervisor ispermitted to execute an instance of a secure guest generated with theimage in the computing system based on a presence or absence of one ormore system settings in the computing system. The program codeintercepts a command by the hypervisor to initiate the instance of thesecure guest from the image of the secure guest. The program codedetermines the presence or the absence of the one or more systemsettings in the computing system. The program code determines, based onthe one or more controls and the presence or the absence of the one ormore system settings, if the hypervisor is permitted to execute theinstance. Based on determining that the hypervisor is permitted toexecute the instance, the program code enables initiation of theinstance by the hypervisor, in the computing system, based on relayingthe intercepted command to the hypervisor. Based on determining that thehypervisor is not permitted to execute the instance, the program codeignores the command.

In some embodiments of the present invention, when the program codeobtains the metadata, the program code decrypts a portion of themetadata linked to the image of the secure guest, wherein the metadatais integrity protected and the portion comprising a cryptographicmeasure of a boot image of the secure guest was encrypted by a keyderived using a private key. In some embodiments of the presentinvention, the encrypted portion of the metadata comprises the one ormore controls. Each control of the one or more controls can comprise anenvironmental constraint. In some embodiments of the present invention,the environmental constraints are selected from the group consisting of:systems configured to perform hardware measurements, and systemsconfigured to use a non-system specific host key.

In some embodiments of the present invention, the private key is ownedby the secure interface control and used exclusively by the secureinterface control.

In some embodiments of the present invention, the key derived using theprivate key is shared between the secure interface control and theowner.

In some embodiments of the present invention, the metadata comprisesvalues derived from a boot image of the secure guest computed utilizinga collision resistant one-way function.

In some embodiments of the present invention, the one or more controlseach comprise a positive designation or a negative designation for agiven system settings, where the positive designation indicates that theinstance of the secure guest is permitted to execute in the computingsystem comprising the given system setting and the negative designationindicates that the instance of the secure guest is not permitted toexecute in the computing system comprising the given system setting.

In some embodiments of the present invention, the metadata isinaccessible to the instance of the secure guest.

In some embodiments of the present invention, the program codedetermining if the hypervisor is permitted to execute the instancefurther comprises: the program code identifying, in the one or morecontrols, a control relevant to a setting of the one or more systemsettings; and the program code determining if the control enables orrestricts executing the instance, based on the control.

In some embodiments of the present invention, the program code monitorsthe one or more system settings during runtime of the instance. Theprogram code determines that at least one setting of the one or moresettings changed during the runtime. The program code identifies a givencontrol of the one or more controls relevant to the at least onesetting. The program code determines, based on the at least one settingand the given control if the hypervisor is permitted to execute theinstance. Based on determining that the hypervisor is not permitted toexecute the instance, the program code can terminate, via thehypervisor, the instance.

In some embodiments of the present invention, the program codeintercepting the command by the hypervisor to initiate the instance ofthe secure guest from the image of the secure guest further comprises:the program code performing an integrity check on the metadata; andbased on successfully completing the integrity check, the program codereading the one or more controls in the metadata.

Referring now to FIG. 4, a schematic of an example of a computing node,which can be a cloud computing node 10. Cloud computing node 10 is onlyone example of a suitable cloud computing node and is not intended tosuggest any limitation as to the scope of use or functionality ofembodiments of the invention described herein. Regardless, cloudcomputing node 10 is capable of being implemented and/or performing anyof the functionality set forth hereinabove. In an embodiment of thepresent invention, the secure guest 210 (FIG. 2), the secure interfacecontrol 230 (FIG. 2), and/or the hypervisor 220 (FIG. 2) can each beunderstood as executing on a cloud computing node 10 (FIG. 4) and if nota cloud computing node 10, then one or more general computing nodes thatinclude aspects of the cloud computing node 10.

In cloud computing node 10 there is a computer system/server 12, whichis operational with numerous other general purpose or special purposecomputing system environments or configurations. Examples of well-knowncomputing systems, environments, and/or configurations that may besuitable for use with computer system/server 12 include, but are notlimited to, personal computer systems, server computer systems, thinclients, thick clients, handheld or laptop devices, multiprocessorsystems, microprocessor-based systems, set top boxes, programmableconsumer electronics, network PCs, minicomputer systems, mainframecomputer systems, and distributed cloud computing environments thatinclude any of the above systems or devices, and the like.

Computer system/server 12 may be described in the general context ofcomputer system-executable instructions, such as program modules, beingexecuted by a computer system. Generally, program modules may includeroutines, programs, objects, components, logic, data structures, and soon that perform particular tasks or implement particular abstract datatypes. Computer system/server 12 may be practiced in distributed cloudcomputing environments where tasks are performed by remote processingdevices that are linked through a communications network. In adistributed cloud computing environment, program modules may be locatedin both local and remote computer system storage media including memorystorage devices.

As shown in FIG. 4, computer system/server 12 that can be utilized ascloud computing node 10 is shown in the form of a general-purposecomputing device. The components of computer system/server 12 mayinclude, but are not limited to, one or more processors or processingunits 16, a system memory 28, and a bus 18 that couples various systemcomponents including system memory 28 to processor 16.

Bus 18 represents one or more of any of several types of bus structures,including a memory bus or memory controller, a peripheral bus, anaccelerated graphics port, and a processor or local bus using any of avariety of bus architectures. By way of example, and not limitation,such architectures include Industry Standard Architecture (ISA) bus,Micro Channel Architecture (MCA) bus, Enhanced ISA (EISA) bus, VideoElectronics Standards Association (VESA) local bus, and PeripheralComponent Interconnect (PCI) bus.

Computer system/server 12 typically includes a variety of computersystem readable media. Such media may be any available media that isaccessible by computer system/server 12, and it includes both volatileand non-volatile media, removable and non-removable media.

System memory 28 can include computer system readable media in the formof volatile memory, such as random access memory (RAM) 30 and/or cachememory 32. Computer system/server 12 may further include otherremovable/non-removable, volatile/non-volatile computer system storagemedia. By way of example only, storage system 34 can be provided forreading from and writing to a non-removable, non-volatile magnetic media(not shown and typically called a “hard drive”). Although not shown, amagnetic disk drive for reading from and writing to a removable,non-volatile magnetic disk (e.g., a “floppy disk”), and an optical diskdrive for reading from or writing to a removable, non-volatile opticaldisk such as a CD-ROM, DVD-ROM or other optical media can be provided.In such instances, each can be connected to bus 18 by one or more datamedia interfaces. As will be further depicted and described below,memory 28 may include at least one program product having a set (e.g.,at least one) of program modules that are configured to carry out thefunctions of embodiments of the invention.

Program/utility 40, having a set (at least one) of program modules 42,may be stored in memory 28 by way of example, and not limitation, aswell as an operating system, one or more application programs, otherprogram modules, and program data. Each of the operating system, one ormore application programs, other program modules, and program data orsome combination thereof, may include an implementation of a networkingenvironment. Program modules 42 generally carry out the functions and/ormethodologies of embodiments of the invention as described herein.

Computer system/server 12 may also communicate with one or more externaldevices 14 such as a keyboard, a pointing device, a display 24, etc.;one or more devices that enable a user to interact with computersystem/server 12; and/or any devices (e.g., network card, modem, etc.)that enable computer system/server 12 to communicate with one or moreother computing devices. Such communication can occur via Input/Output(I/O) interfaces 22. Still yet, computer system/server 12 cancommunicate with one or more networks such as a local area network(LAN), a general wide area network (WAN), and/or a public network (e.g.,the Internet) via network adapter 20. As depicted, network adapter 20communicates with the other components of computer system/server 12 viabus 18. It should be understood that although not shown, other hardwareand/or software components could be used in conjunction with computersystem/server 12. Examples include, but are not limited to: microcode,device drivers, redundant processing units, external disk drive arrays,RAID systems, tape drives, and data archival storage systems, etc.

It is to be understood that although this disclosure includes a detaileddescription on cloud computing, implementation of the teachings recitedherein are not limited to a cloud computing environment. Rather,embodiments of the present invention are capable of being implemented inconjunction with any other type of computing environment now known orlater developed.

Cloud computing is a model of service delivery for enabling convenient,on-demand network access to a shared pool of configurable computingresources (e.g., networks, network bandwidth, servers, processing,memory, storage, applications, virtual machines, and services) that canbe rapidly provisioned and released with minimal management effort orinteraction with a provider of the service. This cloud model may includeat least five characteristics, at least three service models, and atleast four deployment models.

Characteristics are as follows:

On-demand self-service: a cloud consumer can unilaterally provisioncomputing capabilities, such as server time and network storage, asneeded automatically without requiring human interaction with theservice's provider.

Broad network access: capabilities are available over a network andaccessed through standard mechanisms that promote use by heterogeneousthin or thick client platforms (e.g., mobile phones, laptops, and PDAs).Resource pooling: the provider's computing resources are pooled to servemultiple consumers using a multi-tenant model, with different physicaland virtual resources dynamically assigned and reassigned according todemand. There is a sense of location independence in that the consumergenerally has no control or knowledge over the exact location of theprovided resources but may be able to specify location at a higher levelof abstraction (e.g., country, state, or datacenter). Rapid elasticity:capabilities can be rapidly and elastically provisioned, in some casesautomatically, to quickly scale out and rapidly released to quicklyscale in. To the consumer, the capabilities available for provisioningoften appear to be unlimited and can be purchased in any quantity at anytime.

Measured service: cloud systems automatically control and optimizeresource use by leveraging a metering capability at some level ofabstraction appropriate to the type of service (e.g., storage,processing, bandwidth, and active user accounts). Resource usage can bemonitored, controlled, and reported, providing transparency for both theprovider and consumer of the utilized service.

Service Models are as follows:

Software as a Service (SaaS): the capability provided to the consumer isto use the provider's applications running on a cloud infrastructure.The applications are accessible from various client devices through athin client interface such as a web browser (e.g., web-based e-mail).The consumer does not manage or control the underlying cloudinfrastructure including network, servers, operating systems, storage,or even individual application capabilities, with the possible exceptionof limited user specific application configuration settings.

Platform as a Service (PaaS): the capability provided to the consumer isto deploy onto the cloud infrastructure consumer-created or acquiredapplications created using programming languages and tools supported bythe provider. The consumer does not manage or control the underlyingcloud infrastructure including networks, servers, operating systems, orstorage, but has control over the deployed applications and possiblyapplication hosting environment configurations.

Infrastructure as a Service (IaaS): the capability provided to theconsumer is to provision processing, storage, networks, and otherfundamental computing resources where the consumer is able to deploy andrun arbitrary software, which can include operating systems andapplications. The consumer does not manage or control the underlyingcloud infrastructure but has control over operating systems, storage,deployed applications, and possibly limited control of select networkingcomponents (e.g., host firewalls).

Deployment Models are as follows:

Private cloud: the cloud infrastructure is operated solely for anorganization. It may be managed by the organization or a third party andmay exist on-premises or off premises.

Community cloud: the cloud infrastructure is shared by severalorganizations and supports a specific community that has shared concerns(e.g., mission, security requirements, policy, and complianceconsiderations). It may be managed by the organizations or a third partyand may exist on-premises or off-premises.

Public cloud: the cloud infrastructure is made available to the generalpublic or a large industry group and is owned by an organization sellingcloud services.

Hybrid cloud: the cloud infrastructure is a composition of two or moreclouds (private, community, or public) that remain unique entities butare bound together by standardized or proprietary technology thatenables data and application portability (e.g., cloud bursting forload-balancing between clouds).

A cloud computing environment is service oriented with a focus onstatelessness, low coupling, modularity, and semantic interoperability.At the heart of cloud computing is an infrastructure that includes anetwork of interconnected nodes.

Referring now to FIG. 5, illustrative cloud computing environment 50 isdepicted. As shown, cloud computing environment 50 includes one or morecloud computing nodes 10 with which local computing devices used bycloud consumers, such as, for example, personal digital assistant (PDA)or cellular telephone 54A, desktop computer 54B, laptop computer 54C,and/or automobile computer system 54N may communicate. Nodes 10 maycommunicate with one another. They may be grouped (not shown) physicallyor virtually, in one or more networks, such as Private, Community,Public, or Hybrid clouds as described hereinabove, or a combinationthereof. This allows cloud computing environment 50 to offerinfrastructure, platforms and/or software as services for which a cloudconsumer does not need to maintain resources on a local computingdevice. It is understood that the types of computing devices 54A-N shownin FIG. 5 are intended to be illustrative only and that computing nodes10 and cloud computing environment 50 can communicate with any type ofcomputerized device over any type of network and/or network addressableconnection (e.g., using a web browser).

Referring now to FIG. 6, a set of functional abstraction layers providedby cloud computing environment 50 (FIG. 5) is shown. It should beunderstood in advance that the components, layers, and functions shownin FIG. 6 are intended to be illustrative only and embodiments of theinvention are not limited thereto. As depicted, the following layers andcorresponding functions are provided:

Hardware and software layer 60 includes hardware and softwarecomponents. Examples of hardware components include: mainframes 61; RISC(Reduced Instruction Set Computer) architecture based servers 62;servers 63; blade servers 64; storage devices 65; and networks andnetworking components 66. In some embodiments, software componentsinclude network application server software 67 and database software 68.

Virtualization layer 70 provides an abstraction layer from which thefollowing examples of virtual entities may be provided: virtual servers71; virtual storage 72; virtual networks 73, including virtual privatenetworks; virtual applications and operating systems 74; and virtualclients 75.

In one example, management layer 80 may provide the functions describedbelow. Resource provisioning 81 provides dynamic procurement ofcomputing resources and other resources that are utilized to performtasks within the cloud computing environment. Metering and Pricing 82provide cost tracking as resources are utilized within the cloudcomputing environment, and billing or invoicing for consumption of theseresources. In one example, these resources may include applicationsoftware licenses. Security provides identity verification for cloudconsumers and tasks, as well as protection for data and other resources.User portal 83 provides access to the cloud computing environment forconsumers and system administrators. Service level management 84provides cloud computing resource allocation and management such thatrequired service levels are met. Service Level Agreement (SLA) planningand fulfillment 85 provide pre-arrangement for, and procurement of,cloud computing resources for which a future requirement is anticipatedin accordance with an SLA.

Workloads layer 90 provides examples of functionality for which thecloud computing environment may be utilized. Examples of workloads andfunctions which may be provided from this layer include: mapping andnavigation 91; software development and lifecycle management 92; virtualclassroom education delivery 93; data analytics processing 94;transaction processing 95; and controlling the execution a secure guest,based on environmental factors, via a secure interface control 96.

The present invention may be a system, a method, and/or a computerprogram product at any possible technical detail level of integration.The computer program product may include a computer readable storagemedium (or media) having computer readable program instructions thereonfor causing a processor to carry out aspects of the present invention.

The computer readable storage medium can be a tangible device that canretain and store instructions for use by an instruction executiondevice. The computer readable storage medium may be, for example, but isnot limited to, an electronic storage device, a magnetic storage device,an optical storage device, an electromagnetic storage device, asemiconductor storage device, or any suitable combination of theforegoing. A non-exhaustive list of more specific examples of thecomputer readable storage medium includes the following: a portablecomputer diskette, a hard disk, a random access memory (RAM), aread-only memory (ROM), an erasable programmable read-only memory (EPROMor Flash memory), a static random access memory (SRAM), a portablecompact disc read-only memory (CD-ROM), a digital versatile disk (DVD),a memory stick, a floppy disk, a mechanically encoded device such aspunch-cards or raised structures in a groove having instructionsrecorded thereon, and any suitable combination of the foregoing. Acomputer readable storage medium, as used herein, is not to be construedas being transitory signals per se, such as radio waves or other freelypropagating electromagnetic waves, electromagnetic waves propagatingthrough a waveguide or other transmission media (e.g., light pulsespassing through a fiber-optic cable), or electrical signals transmittedthrough a wire.

Computer readable program instructions described herein can bedownloaded to respective computing/processing devices from a computerreadable storage medium or to an external computer or external storagedevice via a network, for example, the Internet, a local area network, awide area network and/or a wireless network. The network may comprisecopper transmission cables, optical transmission fibers, wirelesstransmission, routers, firewalls, switches, gateway computers and/oredge servers. A network adapter card or network interface in eachcomputing/processing device receives computer readable programinstructions from the network and forwards the computer readable programinstructions for storage in a computer readable storage medium withinthe respective computing/processing device.

Computer readable program instructions for carrying out operations ofthe present invention may be assembler instructions,instruction-set-architecture (ISA) instructions, machine instructions,machine dependent instructions, microcode, firmware instructions,state-setting data, configuration data for integrated circuitry, oreither source code or object code written in any combination of one ormore programming languages, including an object oriented programminglanguage such as Smalltalk, C++, or the like, and procedural programminglanguages, such as the “C” programming language or similar programminglanguages. The computer readable program instructions may executeentirely on the user's computer, partly on the user's computer, as astand-alone software package, partly on the user's computer and partlyon a remote computer or entirely on the remote computer or server. Inthe latter scenario, the remote computer may be connected to the user'scomputer through any type of network, including a local area network(LAN) or a wide area network (WAN), or the connection may be made to anexternal computer (for example, through the Internet using an InternetService Provider). In some embodiments, electronic circuitry including,for example, programmable logic circuitry, field-programmable gatearrays (FPGA), or programmable logic arrays (PLA) may execute thecomputer readable program instructions by utilizing state information ofthe computer readable program instructions to personalize the electroniccircuitry, in order to perform aspects of the present invention.

Aspects of the present invention are described herein with reference toflowchart illustrations and/or block diagrams of methods, apparatus(systems), and computer program products according to embodiments of theinvention. It will be understood that each block of the flowchartillustrations and/or block diagrams, and combinations of blocks in theflowchart illustrations and/or block diagrams, can be implemented bycomputer readable program instructions.

These computer readable program instructions may be provided to aprocessor of a general purpose computer, special purpose computer, orother programmable data processing apparatus to produce a machine, suchthat the instructions, which execute via the processor of the computeror other programmable data processing apparatus, create means forimplementing the functions/acts specified in the flowchart and/or blockdiagram block or blocks. These computer readable program instructionsmay also be stored in a computer readable storage medium that can directa computer, a programmable data processing apparatus, and/or otherdevices to function in a particular manner, such that the computerreadable storage medium having instructions stored therein comprises anarticle of manufacture including instructions which implement aspects ofthe function/act specified in the flowchart and/or block diagram blockor blocks.

The computer readable program instructions may also be loaded onto acomputer, other programmable data processing apparatus, or other deviceto cause a series of operational steps to be performed on the computer,other programmable apparatus or other device to produce a computerimplemented process, such that the instructions which execute on thecomputer, other programmable apparatus, or other device implement thefunctions/acts specified in the flowchart and/or block diagram block orblocks.

The flowchart and block diagrams in the Figures illustrate thearchitecture, functionality, and operation of possible implementationsof systems, methods, and computer program products according to variousembodiments of the present invention. In this regard, each block in theflowchart or block diagrams may represent a module, segment, or portionof instructions, which comprises one or more executable instructions forimplementing the specified logical function(s). In some alternativeimplementations, the functions noted in the blocks may occur out of theorder noted in the Figures. For example, two blocks shown in successionmay, in fact, be executed substantially concurrently, or the blocks maysometimes be executed in the reverse order, depending upon thefunctionality involved. It will also be noted that each block of theblock diagrams and/or flowchart illustration, and combinations of blocksin the block diagrams and/or flowchart illustration, can be implementedby special purpose hardware-based systems that perform the specifiedfunctions or acts or carry out combinations of special purpose hardwareand computer instructions.

The terminology used herein is for the purpose of describing particularembodiments only and is not intended to be limiting. As used herein, thesingular forms “a”, “an” and “the” are intended to include the pluralforms as well, unless the context clearly indicates otherwise. It willbe further understood that the terms “comprises” and/or “comprising”,when used in this specification, specify the presence of statedfeatures, integers, steps, operations, elements, and/or components, butdo not preclude the presence or addition of one or more other features,integers, steps, operations, elements, components and/or groups thereof.

The corresponding structures, materials, acts, and equivalents of allmeans or step plus function elements in the claims below, if any, areintended to include any structure, material, or act for performing thefunction in combination with other claimed elements as specificallyclaimed. The description of one or more embodiments has been presentedfor purposes of illustration and description, but is not intended to beexhaustive or limited to in the form disclosed. Many modifications andvariations will be apparent to those of ordinary skill in the art. Theembodiment was chosen and described in order to best explain variousaspects and the practical application, and to enable others of ordinaryskill in the art to understand various embodiments with variousmodifications as are suited to the particular use contemplated.

What is claimed is:
 1. A computer-implemented method, comprising:obtaining, by a secure interface control in a computing system, whereinthe secure interface control is communicatively coupled to a hypervisor,wherein the hypervisor manages one or more guests, metadata linked to animage of a secure guest of an owner and managed by the hypervisor,wherein the metadata comprises one or more controls, wherein eachcontrol of the one or more controls indicates to the secure interfacecontrol whether the hypervisor is permitted to execute an instance of asecure guest generated with the image in the computing system based on apresence or absence of one or more system settings in the computingsystem; intercepting, by the secure interface control, a command by thehypervisor to initiate the instance of the secure guest from the imageof the secure guest; determining, by the secure interface control, thepresence or the absence of the one or more system settings in thecomputing system; determining, by the secure interface control, based onthe one or more controls and the presence or the absence of the one ormore system settings, if the hypervisor is permitted to execute theinstance; based on determining that the hypervisor is permitted toexecute the instance: enabling, by the secure interface control,initiation of the instance by the hypervisor, in the computing system,based on relaying the intercepted command to the hypervisor; monitoring,by the secure interface control, the one or more system settings duringruntime of the instance; determining, by the secure interface control,that at least one setting of the one or more settings changed during theruntime; identifying, by the secure interface control, a given controlof the one or more controls relevant to the at least one setting; anddetermining, by the secure interface control, based on the at least onesetting and the given control if the hypervisor is permitted to executethe instance; and based on determining that the hypervisor is notpermitted to execute the instance: ignoring, by the secure interfacecontrol, the command.
 2. The computer-implemented method of claim 1,wherein obtaining the metadata further comprises: decrypting, by thesecure interface control, a portion of the metadata linked to the imageof the secure guest, wherein the metadata is integrity protected and theportion comprising a cryptographic measure of a boot image of the secureguest was encrypted by a key derived using a private key.
 3. Thecomputer-implemented method of claim 2, wherein the encrypted portion ofthe metadata comprises the one or more controls.
 4. Thecomputer-implemented method of claim 2, wherein the private key is ownedby the secure interface control and used exclusively by the secureinterface control.
 5. The computer-implemented method of claim 4,wherein the key derived using the private key is shared between thesecure interface control and the owner.
 6. The computer-implementedmethod of claim 1, wherein each control of the one or more controlscomprises an environmental constraint.
 7. The computer-implementedmethod of claim 6, wherein the environmental constraints are selectedfrom the group consisting of: systems configured to perform hardwaremeasurements, and systems configured to use a non-system specific hostkey.
 8. The computer-implemented method of claim 1, wherein the metadatacomprises values derived from a boot image of the secure guest computedutilizing a collision resistant one-way function.
 9. Thecomputer-implemented method of claim 1, wherein the one or more controlseach comprise a positive designation or a negative designation for agiven system settings, wherein the positive designation indicates thatthe instance of the secure guest is permitted to execute in thecomputing system comprising the given system setting and the negativedesignation indicates that the instance of the secure guest is notpermitted to execute in the computing system comprising the given systemsetting.
 10. The computer-implemented method of claim 1, wherein themetadata is inaccessible to the instance of the secure guest.
 11. Thecomputer-implemented method of claim 1, wherein determining if thehypervisor is permitted to execute the instance further comprises:identifying, by the secure interface control, in the one or morecontrols, a control relevant to a setting of the one or more systemsettings; and determining, by the secure interface control, if thecontrol enables or restricts executing the instance, based on thecontrol.
 12. The computer-implemented method of claim 1, furthercomprising: based on determining that the hypervisor is not permitted toexecute the instance, terminating, by the secure interface control, viathe hypervisor, the instance.
 13. The computer-implemented method ofclaim 1, wherein intercepting the command by the hypervisor to initiatethe instance of the secure guest from the image of the secure guestfurther comprises: performing, by secure interface control, an integritycheck on the metadata; and based on successfully completing theintegrity check, reading, by the secure interface control, the one ormore controls in the metadata.
 14. A computer program productcomprising: a computer readable storage medium readable by one or moreprocessors and storing instructions for execution by the one or moreprocessors for performing a method comprising: obtaining, by the one ormore processors in a computing system, wherein the one or moreprocessors are communicatively coupled to a hypervisor, wherein thehypervisor manages one or more guests, metadata linked to an image of asecure guest of an owner and managed by the hypervisor, wherein themetadata comprises one or more controls, wherein each control of the oneor more controls indicates to the one or more processors whether thehypervisor is permitted to execute an instance of a secure guestgenerated with the image in the computing system based on a presence orabsence of one or more system settings in the computing system;intercepting, by the one or more processors, a command by the hypervisorto initiate the instance of the secure guest from the image of thesecure guest; determining, by the one or more processors, the presenceor the absence of the one or more system settings in the computingsystem; determining, by the one or more processors, based on the one ormore controls and the presence or the absence of the one or more systemsettings, if the hypervisor is permitted to execute the instance; basedon determining that the hypervisor is permitted to execute the instance:enabling, by the secure interface control, initiation of the instance bythe hypervisor, in the computing system, based on relaying theintercepted command to the hypervisor; monitoring, by the secureinterface control, the one or more system settings during runtime of theinstance; determining, by the secure interface control, that at leastone setting of the one or more settings changed during the runtime;identifying, by the secure interface control, a given control of the oneor more controls relevant to the at least one setting; and determining,by the secure interface control, based on the at least one setting andthe given control if the hypervisor is permitted to execute theinstance; and based on determining that the hypervisor is not permittedto execute the instance: ignoring, by the secure interface control, thecommand.
 15. The computer program product of claim 14, wherein obtainingthe metadata further comprises: decrypting, by the one or moreprocessors, a portion of the metadata linked to the image of the secureguest, wherein the metadata is integrity protected and the portioncomprising a cryptographic measure of a boot image of the secure guestwas encrypted by a key derived using a private key.
 16. The computerprogram product of claim 15, wherein the encrypted portion of themetadata comprises the one or more controls.
 17. The computer programproduct of claim 14, wherein each control of the one or more controlscomprises an environmental constraint.
 18. The computer program productof claim 17, wherein the environmental constraints are selected from thegroup consisting of: systems configured to perform hardwaremeasurements, and systems configured to use a non-system specific hostkey.
 19. A computer system comprising: a memory; one or more processorsin communication with the memory; program instructions executable by theone or more processors via the memory to perform a method, the methodcomprising: obtaining, by the one or more processors in the computingsystem, wherein the one or more processors are communicatively coupledto a hypervisor, wherein the hypervisor manages one or more guests,metadata linked to an image of a secure guest of an owner and managed bythe hypervisor, wherein the metadata comprises one or more controls,wherein each control of the one or more controls indicates to the one ormore processors whether the hypervisor is permitted to execute aninstance of a secure guest generated with the image in the computingsystem based on a presence or absence of one or more system settings inthe computing system; intercepting, by the one or more processors, acommand by the hypervisor to initiate the instance of the secure guestfrom the image of the secure guest; determining, by the one or moreprocessors, the presence or the absence of the one or more systemsettings in the computing system; determining, by the one or moreprocessors, based on the one or more controls and the presence or theabsence of the one or more system settings, if the hypervisor ispermitted to execute the instance; based on determining that thehypervisor is permitted to execute the instance: enabling, by the secureinterface control, initiation of the instance by the hypervisor, in thecomputing system, based on relaying the intercepted command to thehypervisor; monitoring, by the secure interface control, the one or moresystem settings during runtime of the instance; determining, by thesecure interface control, that at least one setting of the one or moresettings changed during the runtime; identifying, by the secureinterface control, a given control of the one or more controls relevantto the at least one setting; and determining, by the secure interfacecontrol, based on the at least one setting and the given control if thehypervisor is permitted to execute the instance; and based ondetermining that the hypervisor is not permitted to execute theinstance: ignoring, by the secure interface control, the command.